[SECURITY] Fedora 34 Update: lasso-2.7.0-1.fc34

Lasso is a library that implements the Liberty Alliance Single Sign On standards, including the SAML and SAML2 specifications. It allows to handle the whole life-cycle of SAML based Federations, and provides bindings for multiple languages...

Debian: Security Advisory (DLA-2684-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2684-1 : lasso security update

A vulnerability was discovered in lasso, a library for Liberty Alliance and SAML protocols, which results to a improper verification of a cryptographic signature. For Debian 9 stretch, this problem has been fixed in version 2.5.0-5+deb9u1. We recommend that you upgrade your lasso packages. For th...

[SECURITY] [DLA 2684-1] lasso security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2684-1 [email protected] https://www.debian.org/lts/security/ Yadd June 10, 2021 https://wiki.debian.org/LTS - -------------------------------------------------------------------------...

The vulnerability of the Lasso library, related to insecure management of privileges, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Lasso library is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker, operating remotely, to compromise the confidentiality, integrity, and accessibility of the protected information...

DLA-2684-1 lasso - security update

Bulletin has no description...

Debian DSA-4926-1 : lasso - security update

It was discovered that lasso, a library which implements SAML 2.0 and Liberty Alliance standards, did not properly verify that all assertions in a SAML response were properly signed, allowing an attacker to impersonate users or bypass access control. %NASLMINLEVEL 70300 C Tenable Network Security...

FreeBSD : lasso -- signature checking failure (417de1e6-c31b-11eb-9633-b42e99a1b9c3)

entrouvert reports : When AuthnResponse messages are not signed which is permitted by the specifiation, all assertion's signatures should be checked, but currently after the first signed assertion is checked all following assertions are accepted without checking their signature, and the last one ...

SOGo < 2.4.1, 3.x < 5.1.1 Multiple Vulnerabilities

SOGo is prone to multiple vulnerabilities in SAML. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:alinto:sogo"; if description...

Debian: Security Advisory (DSA-4926-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-28091

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature...

DEBIAN-CVE-2021-28091

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature...

CVE-2021-28091

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature...

AZL-7255 CVE-2021-28091 affecting package lasso for versions less than 2.8.0-1

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature...

CVE-2021-28091

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature...

Design/Logic Flaw

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature...

CVE-2021-28091

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature...

CVE-2021-28091

CVE-2021-28091 affects the Lasso library. All versions prior to 2.7.0 are vulnerable due to improper verification of a cryptographic signature in SAML/XML signature processing, which can allow manipulation of SAML responses and potential impersonation. Remediation is to upgrade to version 2.7.0 o...

CVE-2021-28091

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature...

[SECURITY] [DSA 4926-1] lasso security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4926-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 03, 2021 https://www.debian.org/security/faq -...